Mike Auty
57c9470f66
Documentation: Fix building from different directories
2022-01-16 22:09:15 +00:00
ikelos and GitHub
7650cfd7d1
Merge pull request #614 from kevthehermit/plugin/mftscan
...
Create MFTScanner plugin
2022-01-16 14:08:08 +00:00
KevTheHermit
e3a7ac5668
Use lookups on mft enums instead of choices
2022-01-16 02:20:55 +00:00
ikelos and GitHub
45e2597399
Merge pull request #610 from volatilityfoundation/feature/pretty-multiline-output
...
CLI: Support multi-line fields and tabstops in pretty renderer
2022-01-16 01:34:13 +00:00
ikelos and GitHub
84df55a15b
Merge pull request #612 from volatilityfoundation/issues/issue588
...
Automagic: Allow automagic to exclude unsupported OSes
2022-01-16 01:28:52 +00:00
Mike Auty
a31f846b14
Documentation: Reorganize and consolidate pages
2022-01-16 00:47:40 +00:00
KevTheHermit
f31bc853c4
remove MFTIntermedSymbols
2022-01-15 23:30:39 +00:00
Mike Auty
742d46786b
Plugins: Don't forget missing values
2022-01-15 22:56:36 +00:00
Mike Auty
d9ba3e6bd9
Plugins: Timeliner improve support for body files
2022-01-15 22:50:21 +00:00
Mike Auty
dab746aff0
Plugins: yara python module check improvement
...
Fixes #616
2022-01-15 22:44:24 +00:00
KevTheHermit
32abab8733
Remove debug print from mftscan
2022-01-15 22:38:05 +00:00
Mike Auty
a9e5589260
Documentation: Add summary table for linux/mac ISF creation
2022-01-15 22:02:02 +00:00
KevTheHermit
4aaba89d02
Unity timeliner output for mftscan
2022-01-15 21:47:37 +00:00
Mike Auty
8791631db5
Documentation: More minor fixes
2022-01-15 21:40:25 +00:00
Mike Auty
c93e20ab36
Plugins: linux.kmsg update documentation and reformat
2022-01-15 21:14:52 +00:00
Mike Auty
1f7acf2779
Documentation: Update sphinx requirement to 4.0.0
2022-01-15 21:02:20 +00:00
KevTheHermit
c5987a45d2
Relative Offset MFT Header
2022-01-15 20:54:22 +00:00
KevTheHermit
a8f5b03816
Apply yapf to mftscan plugin
2022-01-15 15:57:23 +00:00
KevTheHermit
1c6cd0fb52
Move mftscan enums to ISF file.
2022-01-15 15:53:35 +00:00
ikelos and GitHub
0abff16580
Merge pull request #615 from volatilityfoundation/feature/yara-rules-update
...
Plugins: Update yarascan options
2022-01-13 15:21:41 +00:00
Mike Auty
d91a6f94fb
Automagic: Ensure linxu/mac are excluded from windows automagic
2022-01-13 01:01:20 +00:00
Mike Auty
f67f1e242d
Documentation: Ensure the doc reqs are included in s_dist builds
2022-01-12 22:11:25 +00:00
ikelos and GitHub
13cb2929ec
Merge pull request #619 from volatilityfoundation/release/v2.0.0
...
Release/v2.0.0
2022-01-12 21:49:53 +00:00
Mike Auty
8920fd634a
Merge branch 'release/v2.0.0' into develop
2022-01-12 21:39:12 +00:00
Mike Auty
d469d9c597
Documentation: Update master branch to stable branch
2022-01-12 21:13:32 +00:00
Mike Auty
1f9d6f5baa
Documentation: Update master branch to stable branch
2022-01-12 21:13:05 +00:00
Mike Auty
3294d0a2c2
Documentation: Update README.md before release
2022-01-12 21:06:53 +00:00
Mike Auty
a0b66f33f9
Documentation: Update README.md before release
2022-01-12 21:06:20 +00:00
KevTheHermit
793d08faf4
Add TimeLiner interface to MFTScan plugin
2022-01-09 22:27:32 +00:00
KevTheHermit
9d86599e7f
MFT Plugin use ISF instead of Struct
2022-01-09 22:04:13 +00:00
Mike Auty
d34030e9ea
Plugins: Add note to improve yarascan in the future
2022-01-09 20:53:40 +00:00
Mike Auty
114a8d7c8d
Plugins: Update yarascan options
...
Add in a yara_source option in the process method. Unfortunately
yara_rules is still poorly named, but would require a major version
bump, so to avoid major disruption, we're just adding the yara_source
option instead.
2022-01-09 20:32:34 +00:00
KevTheHermit
295fb453f5
Add MFT Filename N/A type
2022-01-09 00:55:34 +00:00
KevTheHermit
20a5868ff3
Change return types for MFT Records DTGs
2022-01-09 00:23:31 +00:00
KevTheHermit
899ec09ce3
Doc Strings
2022-01-06 23:09:50 +00:00
KevTheHermit
2c949dfa50
Create MFTScanner plugin
2022-01-06 22:53:24 +00:00
Mike Auty
7aed488721
Automagic: Allow automagic to exclude unsupported OSes
2022-01-01 01:21:37 +00:00
Mike Auty
e91e65d64b
Renderers: Make appending rows massively more efficient
...
Previously we were generating the list of children (for most likely the
root node) for every single append statement, during which we were
recalculating the length of the list, twice. In plugins that output a
lot of rows this would add an enourmous overhead (that likely grew as
the length of the output grew). Without this overhead, the time taken
for the TreeGrid._append method went from 1230.0s to 2.4s.
2021-12-31 22:48:21 +00:00
ikelos and GitHub
168b0d0b05
Merge pull request #611 from volatilityfoundation/issues/issue604
...
Renderers: Make appending rows massively more efficient
2021-12-31 22:47:50 +00:00
Mike Auty
65048e3d49
Merge branch 'release/v2.0.0' into develop
2021-12-31 00:59:47 +00:00
Mike Auty
dd13b427e0
Volshell: Update the linux pslist requirement
2021-12-31 00:57:18 +00:00
Mike Auty
ac7127d05a
Volshell: Sync errors with the CLI concerning unsatisfied requirements
...
Fixes #607
2021-12-31 00:55:23 +00:00
Mike Auty
571ab8f659
Volshell: Update the linux pslist requirement
2021-12-31 00:51:21 +00:00
Mike Auty
c13b49262d
Renderers: Make appending rows massively more efficient
...
Previously we were generating the list of children (for most likely the
root node) for every single append statement, during which we were
recalculating the length of the list, twice. In plugins that output a
lot of rows this would add an enourmous overhead (that likely grew as
the length of the output grew). Without this overhead, the time taken
for the TreeGrid._append method went from 1230.0s to 2.4s.
2021-12-30 01:47:51 +00:00
Mike Auty
f38fc22002
CLI: Support multi-line fields and tabstops in pretty renderer
2021-12-29 23:51:28 +00:00
Mike Auty
c8dd8d08bd
Volshell: Synchronize with the standard CLI cache clearing
2021-12-29 22:26:28 +00:00
Mike Auty
7b0a90afa6
Automagic: Warn when multiple symbol files match a banner
2021-12-29 22:19:29 +00:00
ikelos and GitHub
8134b8e2d0
Merge pull request #605 from cstation/qemu_additional_sections
...
QEMU: Add 'dirty-bitmap' and 'pbs-state', handle page_size more consistently
2021-12-29 21:30:15 +00:00
cstation
a96f5de6a0
QEMU: Add 'dirty-bitmap' and 'pbs-state', handle page_size more consistently
2021-12-29 22:19:38 +01:00
Gustavo Moreira
8f8e04da97
vfs_inode is not being used nor required
2021-12-21 15:52:22 +11:00
Mike Auty